Uninstall DetoxCrypto virus (Detailed Removal Instructions) - Sep 2016 updated

Description of DetoxCrypto ransomware virus

Double trouble: DetoxCrypto ransomware has two versions at once

The creators of DetoxCrypto ransomware virus decided to go big this time. They created two versions of the ransomware at once. The virus is known as Pokémon ransomware and Calipso ransomware; however, they both act the same. They spread via executed files, and once they get inside, they encrypt all the data. What is interesting, these computer parasites do not add file extensions to encoded data. Talking about technical DetoxCrypto virus features, it’s important to mention that after hijack, it drops MicrosoftHost.exe file which is responsible for data encryption, blocking database servers and changing desktop’s background with a ransom message. Also, the virus delivers another file (Pokemon.exe or Calipso.exe) that activates decryption tools if the victim purchases a decryption key. Moreover, in the background virus plays an audio file. So, you will be warned about the attack loudly. However, do not let hackers scare you or convince to pay the ransom. After the attack, you should initiate DetoxCrypto removal immediately.

According to the recent virus researchers, DetoxCrypto virus managed to find a new way of distribution. It spreads as a fake antivirus program and executes via the malwerbyte.exe file. Indeed, the infected file can be easily confused with the legitimate Malwarebytes Anti-Malware software. The creators of the virus offer to download fake software by delivering misleading advertisements. Also, the malicious file can be attached to an email and sent straight to the victim. So, you should be careful with ads and stay away from suspicious emails. Nevertheless, the newest version of the virus cannot encrypt your files; it still can cause serious computer-related issues. Virus researchers noticed that it’s easy to get rid of the latest virus version. You can remove DetoxCrypto with RestoroIntego.

DetoxCrypto ransomware has several variants that are still threatening and targeting computers all over the world. We are going to talk about the main features of them briefly.

The versions of DetoxCrypto virus

Calipso ransomware virus. If your computer is infected with this version of the ransomware, you will find a ‘Calipso’ folder on your PC. In this folder, virus puts all its components. Soon you will hear an audio file where the voice will tell you about the attack and the ability to decrypt your files. The hackers give three day time to pay 2 Bitcoins (900 GBP). However, the price will increase each day for 1 Bitcoin. So, hackers suggest you don’t delay paying the ransom and contact them via email motox2016@mail2tor.com immediately. We firmly recommend do not listen to the crooks and concentrate on virus removal.

Pokemon ransomware virus (We are all Pokemons virus). This virus is loud and annoying. Once it gets into the computer, it starts playing a silly melody. Meanwhile, it changes desktop background that includes a picture of sad Pikachu. Also, you will see an unpleasant message that you have to send an email to contact365@mail2tor.com, and the crooks will explain to you how to pay the ransom. This time, victims have 96 hours to complete to make the decision. When times runs out, or victims decide to eliminate the virus, all their files will be deleted too. However, paying the ransom doesn’t guarantee that your data will be recovered.

Serpico ransomware virus. This version of DetoxCrypto virus mostly targets users living in Croatia. For contacting with victims, hackers use the same email as Calipso ransomware virus. However, this time, the creators are not so greedy. For file decryption key they only ask for 50 euros (43 GBP). Indeed, many victims decided to pay the ransom. Probably, crooks scooped a huge amount of money. What about victim’s files? No one claimed that they were recovered.

MotoxLocker ransomware virus. The latest version of the virus encodes data using strong AES algorithm. Again, hackers ask to pay a comparatively small amount of money – 50 euros. However, it’s not worth paying because IT specialists have already released a free MotoxLocker decryption tool. But before restoring your files, don’t forget to remove the virus first.

How to protect my computer from DetoxCrypto ransomware?

There are two main ways how DetoxCrypto malware is distributed – malvertising and infected emails. Some sources claim that virus can also spread via exploit kits. If you want to decrease your chances to catch this infection, you should stay away from aggressive advertisements and offers to download particular programs. With one click you can install a ransomware. You should know that the only safe place for downloads and updates are programs’ official websites. Moreover, you can set automatic software updates. Then, you won’t be distracted by misleading ads. Also, you should pay attention to your emails. Do not open any suspicious emails and, especially, do not download any attachments. The hackers might be creative and persuasive. So, if they claim to be from an official institution make sure that the sender actually works there and the message includes real issues. You can look up for information online or contact the organisation directly.

How to remove DetoxCrypto?

Ransomware removal requires powerful anti-malware tools. If you already have an antivirus program, make sure that it is updated. If your computer is unprotected, we recommend installing RestoroIntego. Then, you have to run a full system scan and remove DetoxCrypto from your PC. If the virus blocks malware removal program, reboot your computer to the Safe Mode with Networking and try to run the software again. If you face any problems with DetoxCrypto removal, follow our step-by-step guide bellow.